Microsoft SharePoint Deserialization of Untrusted Data RCE
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Implement strict network segmentation to restrict direct untrusted access to SharePoint servers, possibly placing them behind a WAF configured to block suspicious serialized data payloads. Enhance monitoring for unusual process execution, unexpected network connections, or high-privilege activity originating from SharePoint application pools. Restrict user permissions to the absolute minimum necessary across SharePoint services to reduce the blast radius in case of compromise.
Apply the official security patches released by Microsoft for all affected versions of Microsoft Office SharePoint as soon as they become available. Regularly check Microsoft's security advisories and update guides to ensure all relevant fixes are deployed promptly. Verify successful patch installation and conduct post-patch testing to confirm system stability and the absence of the vulnerability.
An unauthorized attacker can achieve remote code execution (RCE) on the affected Microsoft SharePoint server by exploiting deserialization of untrusted data. This allows for full system compromise, enabling data theft, modification, or even the deployment of ransomware. The business impact can be severe, including significant operational disruption, data breaches, and potential compliance fines.
Other CVEs affecting sharepoint server
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Microsoft SharePoint Server Elevation of Privilege Vulnerability
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.